Google Workspace security checklist for small businesses

What should you lock down first?

Lock down accounts first, because a taken-over account bypasses most of your other settings. These items take the least time and close the biggest gaps:

• Enforce 2-Step Verification for every user. Use our guide to rolling out 2-Step Verification to avoid lockouts.
• Keep super administrator accounts to a small number, usually two or three, so one lost account does not lock you out.
• Give admins separate accounts for admin work, and use their everyday accounts for email and documents.
• Require security keys for admin accounts where you can.
• Set a minimum password length and turn on password strength enforcement.
• Keep recovery phone numbers and email addresses current for every admin.

If you are new to the Admin console, start with Google Workspace Admin console basics. For the reasoning behind each area, see our Google Workspace security and HIPAA guide.

How do you secure email?

You secure email by authenticating your domain and turning on the protections Gmail offers. Work through these items:

• Publish SPF, DKIM, and DMARC records, starting DMARC in monitoring mode.
• Review Gmail's safety settings for attachments, links, and spoofing, and turn on the protections Google recommends.
• Turn on the warning for messages sent to external recipients.
• Decide whether users may automatically forward mail to outside addresses. Many organizations turn this off.
• Decide how sensitive mail is sent. Is Gmail encrypted? explains your options.

How do you protect files and devices?

You protect files with sharing rules and devices with mobile management. For files:

• Set external sharing rules and trusted domains using Google Drive sharing settings that protect your data.
• Make new files default to restricted or organization-only access.
• Move team files into shared drives, so they stay when people leave.

For devices:

• Turn on mobile management so you can require a screen lock and remove company data from a lost or stolen phone. The options available depend on your edition.
• Help users set up the official apps with our guide to setting up Gmail and Google Calendar on phones.

How do you control third-party apps?

You control third-party apps through the app access controls in the Admin console. Many apps ask users for permission to read their mail, files, or calendar, and each one is a possible path to your data.

• Review which third-party apps already have access to your Google Workspace data.
• Block apps you do not trust, and limit access to sensitive data to apps you have approved.
• Restrict which Google Workspace Marketplace apps users can install.
• Remove access for apps no one uses anymore.

How do you stay on top of security over time?

You stay on top of security by reviewing alerts, people changes, and settings on a schedule. A one-time setup drifts as your team changes.

• Check the Alert Center regularly, and make sure alert emails go to someone who reads them.
• Set retention rules if your edition includes Vault. See Google Vault retention and eDiscovery basics.
• Follow a written process when people leave. Our guide to offboarding employees in Google Workspace gives you one.
• If you handle protected health information, review and accept the Google Workspace BAA and confirm your obligations with your compliance officer or counsel.
• Review this checklist every six months.

Next step

If you want a second set of eyes on your settings, our HIPAA setup service works through this checklist with you, or you can contact us.